The ray attack, an inefficient trial to break RSA cryptosystems^∗

Andreas de Vries^†

FH S u ¨dwestfalen University of Applied Sciences, Haldener Straße 182, D-58095 Hagen

Abstract

The basic properties of RSA cryptosystems and some classical attacks on them are described. Derived from geometric properties of the Euler functions, the Euler function rays, a new ansatz to attack RSA cryptosystems is presented. A resulting, albeit inefficient, algorithm is given. It essentially consists of a loop with starting value determined by the Euler function ray and with step width given by a function ω (n) being a multiple of the

e

order ord_n(e), where e denotes the public key exponent and n the RSA modulus. For

√

n = pq and an estimate r < pq for the smaller prime factor p, the running time is given

by T(e,n,r) = O((r − p)lnelnnlnr).

Contents

12

• Introduction
• 1

• RSA cryptosystem
• 2

45
2.1 Properties of an RSA key system . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Classical RSA attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• 3
• The Euler function ray attack
• 7

3.1 The ω-function and the order of a number modulo n . . . . . . . . . . . . . . .
7

3.2 Properties of composed numbers n = pq  . . . . . . . . . . . . . . . . . . . . . 10 3.3 The algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

• 4
• Discussion
• 15

• 15
• A Appendix

A.1 Euler’s Theorem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 A.2 The Carmichael function and Carmichael’s Theorem . . . . . . . . . . . . . . 16

1 Introduction

Since the revolutionary idea of asymmetric cryptosystems was born in the 1970’s, due to Diffie and Hellman [4] and Rivest, Shamir and Adleman [9], public key technology became an indispensable part of contemporary electronically based communication. Its applications range

^∗This paper is a slight modification of [10]

^†e-Mail: [email protected]

1from authentication to digital signatures and are widely considered to be an essential of future applications for e-commerce.
The most popular cryptosystem is RSA. There has been numerous, more or less unsuccessful, attacks on RSA. The strongness of RSA bases on the difficulty to factorize integers as well as to compute the discrete logarithm. For more details, see e.g. [1, 2, 3, 6]; cf. also

http://www.math-it.org

2 RSA cryptosystem

The RSA cryptosystem, named after its inventors Ron Rivest, Adi Shamir, and Len Adleman (1978), was the first public key cryptosystem and is still the most important one. It is based on the dramatic difference between the ease of finding large prime numbers and computing modular powers on the one hand, and the difficulty of factorizing a product of large prime numbers as well as inverting the modular exponentiation.
Generally, in a public key system, each participant has both a public key and a private key, which is held secret. Each key is a piece of information. In the RSA cryptosystem, each key consists of a group of integers. The participants are traditionally called Alice and Bob, and we denote their public and secret keys as P_A, S_A for Alice and P_B, S_B for Bob. All participants create their own pair of public and private keys. Each keeps his private key secret, but can reveal his public key to anyone or can even publish it. It is very convenient that everyone’s public key is available in a public directory, so that any participant can easily obtain the public key of any other participant, just like we nowadays can get anyones phone number from a public phone book.
In the RSA cryptosystem, each participant creates his public and private keys with the following procedure.

1. Select at random two large prime numbers p and q, p = q. (The primes might be more than 200 digits each, i.e. more than 660 bits.)

2. Compute n = pq and the Carmichael function λ (n) = lcm(p−1,q−1).

3. Select an integer d relatively prime to λ (n). (d should be of the magnitude of n, i.e., d /

λ (n).)

4. Compute e as the multiplicative inverse of d modulo λ (n), such that ed = 1 mod λ (n).
This is done efficiently by the extended Euclidean algorithm.

5. Publish the pair P = (e,n) as the public key. 6. Keep secret the pair S = (d,n) as the private or secret key.

For this procedure, the domain of the messages is Z . For each participant of a cryptosystem,

n

the four-tuple (e,d, p,q) ∈ N⁴ is called (individual) RSA key system. The key parameter e is also called the encryption exponent, d the decryption exponent, and n the RSA modulus.

The encryption of a message m ∈ Z associated with a public key P = (e,n) is performed

n

by the function E : Z → Z ,

• n
• n

E(m) = m^e mod n.

(1)
2
The decryption of a ciphertext c ∈ Z associated with the private key S = (d,n) is done by the

n

mapping D : Z → Z ,

• n
• n

D(c) = c^d mod n.

(2)
The procedure where Alice sends an encrypted message to Bob is schematically shown in Figure 1. A qualitatively new possibility offered by public key systems (and being unimple-

Figure 1: Alice sends an encrypted message m to Bob, using his public RSA key P_B.

mentable with symmetric key systems) is the procedure of digital signature. How an RSA cryptosystem enables Alice to digitally sign a message and how Bob can verify that it is signed by Alice is sketched in Figure 2. As a matter of course, this verification in fact is possible only if the authenticity of Alice’s public key P_A is guaranteed such that Bob can assume that it is her key (and not a third person’s one) which he uses. This guarantee is the job of so-called trust centers.

Figure 2: Alice sends a digitally signed message to Bob; Bob uses Alice’s public key to decrypt the message and to verify this way that Alice has signed it with her private key.

The correctness of RSA, i.e., the fact that E and D define inverse functions on Z (D◦E =

n

E ◦D = id_Z ) relies on the simple fact that

n

• m^ed = m mod n
• for m ∈ Z ,

(3)

n

which is immediately proved by the corollary of Carmichael A.7, p. 18. For details see, e.g., [1, 2, 3].

3
Remark 2.1 Often one finds the definition of RSA cryptosystems based on the Euler function ϕ rather than on the Carmichael function λ , cf. [3]. However, since ϕ(pq) = (p− 1)(q− 1), both function values ϕ(pq) and λ (pq) share the same divisors. Therefore, a possible key parameter d relatively prime to λ (pq) is also relatively prime to ϕ(pq), and vice versa. Only the resulting counter key e may differ. To be more precise, any possible RSA key pair of a system based on the Euler function is a possible key pair with respect to the Carmichael function, whereas the reverse is not generally true. (Proof: Since λ (n)|ϕ(n), the equality ed = 1 mod ϕ(n) implies ed = 1 mod λ (n).) Using the Euler function ϕ, the correctness of RSA is shown with the Euler theorem A.2 on p. 16, instead of the corollary of Carmichael.

2.1 Properties of an RSA key system

Theorem 2.2 Let p, q ∈ N be two primes, p,q > 1, p = q. Then the number ν_pq of all possible key pairs (P,S) = ((e, pq),(d, pq)) is given by

ν

_pq = ϕ(λ (pq)).

(4)

The (trivial) keys with e = d = 1 and with e = d = λ (pq)−1 are always possible, and
(p−1)(q−1)

2 < ν_pq

• <
• .

(5)

gcd(p−1,q−1)
Proof. Since ed = 1 mod λ (pq), without restriction to generality we have 0 < e,d < λ (pq). Moreover, gcd(d,λ (pq)) = gcd(e,λ (pq)) = 1, because for an arbitrary integer a wit_∗h gcd(a, λ (pq)) > 1 there exists no b ∈ N such that ab = 1 mod λ (pq). Therefore, e,d ∈ Z_{λ (pq)}. In

turn, to any a ∈ Z^∗_{λ (pq)} there exists an integer b such that ab = 1 mod λ (pq), since Z_λ^∗ _(pq) is a group. But the order of Z^∗_{λ (pq)} is exactly ϕ(λ (pq)).
It is clear that 1 · 1 = 1 mod λ (n), so e = d = 1 are always possible as key parameters.

If e = d = λ (pq) − 1, we have ed = λ ²(pq) − 2λ (pq) + 1 = 1 mod λ (pq), so e and d are

always possible, too. By (47), λ (pq) is even and (by pq ≧ 6) greater than 2, so ν_pq > 2. The maximum number of elements on the other hand is λ (pq)−1.

ꢀ

The plot of all possible RSA key parameters (e,d) reveals general symmetries in the (e,d)- plane. First we observe that if P = (e,n), S = (d,n) is a possible RSA key pair, then trivially

also P^′ = (d,n), S^′ = (e,n) is possible, because ed = de = 1 mod λ (n). Furthermore, if ed = 1 mod λ (n) and 0 < e,d < λ (n)/2, then

• e^′ = λ (n)−e,
• d^′ = λ (n)−d

(6)

satisfy λ (n)/2 < e^′,d^′ < λ (n) as well as e^′d^′ = λ ²(n)−λ (n)(e+d)+ed = ed mod λ (n).
Therefore, P^′ = (e^′,n) and S^′ = (d^′,n) are possible RSA keys, too.

To sum up, all possible RSA key parameters (e,d), plotted in the square lattice [0,λ (n) −
1]² ⊂ N² with edges ranging from 0 to λ (n)−1, form a pattern which is symmetric to both the principal and the secondary square diagonals, see Figure 3. Thus, the region

U = {(e,d) ∈ [0,λ (n)−1]² : 0 < d ≦ min(e,λ (n)−e)}

(7) contains all information to generate the rest of the square lattice by reflections at the main diagonal (d ↔ e) and at the secondary diagonal (6).

4

Figure 3: Plots of the possible RSA key parameter pairs (e,d) ∈ [0,λ (n) − 1]² for different primes p and q, represented as points in the (e,d)-plane. For the first plot, p = 11 and q = 83, for the second one p = 19 and q = 131. The shaded region is U as given by (7).

2.2 Classical RSA attacks

There are several specific methods to break an RSA cryptosystem. The initial situation for an attack is that an eavesdropper knows the public key P = (e,n) and the encrypted message c. For details see, e.g., [1] and [2, §7].

2.2.1 Factorization of the RSA modulus n

If the eavesdropper succeeds in finding the factorization n = pq of n, knowing e he can easily compute d. But factorization of numbers n = pq with

p,q > 10²⁰⁰

(8)
(hence n > 10⁴⁰⁰, i.e., n has length more than about 1320 bits), is difficult with current technology, if p and q differ enough,

|p−q| > 10¹⁰⁰

.

(9)
Otherwise n can be factorized efficiently by exhaustive search of two integers n₊ and n satis-

−

√

fying n = n² − n² , beginning at n₊ = ⌈ n⌉ and n = 0. These two integers then necessarily

−

+

−

• p
• q

obey n =

.

2

It can be proved that, knowing the public key (e,n), factorizing the RSA modulus n is as difficult as finding the secret key (d,n), see [2, §7.2.5].
Factorization is the most efficient known attack on RSA. The fastest known factorization method, the number field sieve of John Pollard in 1988, yields running times for a 10 GHz computer as given in Table 1.

2.2.2 Chosen-plaintext attack

The eavesdropper systematically encrypts all messages m with Bob’s public key P_B until he achieves the ciphertext c. This attack is efficient if the set of messages m is small or if the

5

• magnitude of the number bits
• operations CPU time

n ≈ 10⁵⁰ n ≈ 10⁷⁵ n ≈ 10¹⁰⁰ n ≈ 10²⁰⁰ n ≈ 10³⁰⁰

167 250 330 665

• 1.4·10¹⁰
• 14 seconds

• 2.5 hours
• 9·10¹²

2.3·10¹⁵ 1.2·10²³
26.6 days 3.8 mio years

• 4.9·10¹² years
• 1000 1.5·10²⁹

Table 1: CPU times for factorizing of numbers n on a 10 GHz computer.

message m is short.
“Pad” each message such that its size is of the magnitude of the modulus. Use “probabilistic encryption,” where a given plaintext is mapped onto several ciphertexts.
(10)

2.2.3 Chosen-ciphertext attack

There is a similar method, the chosen-ciphertext attack, which can be applied if Bob signs a document with his private key. The eavesdropper receiving the ciphertext c and wishing to find the decryption m = c^d mod n chooses a random integer s and asks Bob to digitally sign the innocent-looking message c˜ = s^ec mod n. From his answer m˜ = c˜^d it is easy to recover the

original message, because m = m˜ /s mod n.

Never sign unknown documents; before signing a document, always apply a one-way hash function to it.
(11)

2.2.4 Message iteration

Let be c_i ∈ Z be iteratively defined as

n

• c₀ = m,
• c_i = c^e_i−1 mod n
• (i = 1,2,...).

i

In fact, c_i = m^e mod n, and c₁ = c is the ciphertext. The smallest index k with c_k+1 = c₁ is the

iteration exponent or period of m, cf. definition 3.3: it exactly shows (!) the original message,

c_k = m.

Such a period k uniquely exists, it is the order of e modulo λ (n), k = ord_{λ (n)}(e), cf. (15). Thus it divides λ (λ (n)) and ϕ(λ (n)). To avoid an efficient attack by iteration, λ (λ (n)) and the order of e with respect to λ (n) have to be large,

λ (λ (n)), ord_{λ (n)}(e) > 10²⁰⁰

.

(12)
This condition is satisfied for so-called “doubly safe primes” p and q: A prime p is doubly safe, if both (p−1)/2 and (p−3)/4 are primes. For instance, 11, 23, 47, 167, 359 are doubly safe primes. A doubly safe prime p = 11 always has the form 24a−1, or p = −1 mod 24. For two doubly safe primes p, q, we have λ (pq) = 2 ^{p−1 q−1}, and therefore λ (λ (pq)) = lcm(2, ^p−3
,

• 2
• 2
• 2

p−3 q−3

^q−3) =

= (p−3)(q−3)/8.

1

• 2
• 2
• 2
• 2

6

2.2.5 Broadcast decryption by the low-exponent attack

In general, it may be convenient to use a small public key parameter e such that the encryption of a message is easy to compute (for instance for a small chip card). However, suppose Alice sends the same message to l different participants whose public keys are P = (e,n_i) where

i

the n_i’s are relatively prime to each other and l ≦ e; to emphasize, the public keys have the same encryption exponent e. If an eavesdropper receives the l ciphertexts c^′_i = m^e mod n_i, he can easily compute c^′ = c_i^′ mod n₁ ···n_l by the Chinese remainder theorem. But if the product